router

#!/usr/bin/env node

/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

require('../lib/baseExceptions').addExceptionHandler();

const fs = require('fs');
const http = require('http');
const path = require('path');
const url = require('url');

const hood = require('hood');
const express = require('express');
const urlparse = require('urlparse');

const addP3PHeader = require('../lib/p3p.js');
const config = require('../lib/configuration.js');
const forward = require('../lib/http_forward').forward;
const heartbeat = require('../lib/heartbeat.js');
const logger = require('../lib/logging/logging.js').logger;
const metrics = require('../lib/logging/middleware/metrics.js');
const proxySecure = require('../lib/proxy-secure');
const shutdown = require('../lib/shutdown.js');
const statsd = require('../lib/logging/middleware/statsd.js');
const toobusy = require('../lib/busy_middleware.js');
const wsapi = require('../lib/wsapi.js');

var app = express.createServer();

logger.info("router server starting up");

if (config.get('env') === 'production') {
  logger.info('node.js version: ' + process.version + ' at ' + process.execPath);
  logger.info('configuration: ', JSON.stringify(JSON.parse(config.toString())));
}

// verify that we have a keysigner configured
if (!config.get('keysigner_url')) {
  logger.error('missing required configuration - url for the keysigner (KEYSIGNER_URL in env)');
  process.exit(1);
}

// verify that we have a dbwriter configured
if (!config.get('dbwriter_url')) {
  logger.error('missing required configuration - url for the dbwriter (DBWRITER_URL in env)');
  process.exit(1);
}

// verify that we have a browserid configured
if (!config.get('browserid_url')) {
  logger.error('missing required configuration - url for browserid (BROWSERID_URL in env)');
  process.exit(1);
}

// NOTE: ordering of middleware registration is important in this file, it is the
// order in which middleware will be invoked as requests are processed.

// #1 - Setup health check / heartbeat middleware.
// Depends on positive health checks from browserid and static processes
// This is in front of logging on purpose.  see issue #537
var browserid_url = urlparse(config.get('browserid_url')).validate().normalize().originOnly();
var static_url = urlparse(config.get('static_url')).validate().normalize().originOnly();
heartbeat.setup(app, {
  dependencies: [browserid_url, static_url]
});

app.use(toobusy);

// #2 - logging!  all requests other than __heartbeat__ are logged
app.use(express.logger({
  format: config.get('express_log_format'),
  stream: {
    write: function(x) {
      logger.info(typeof x === 'string' ? x.trim() : x);
    }
  }
}));

// limit all content bodies to 10kb, at which point we'll forcefully
// close down the connection. 
app.use(express.limit("10kb"));

app.use(statsd());

// cover our head
app.use(proxySecure());
app.use(hood({
  csp: false, // CSP breaks FxOS, see bug #4144
  hsts: config.get('hsts'),
  xframe: false // browserid and static will handle their own xframe headers
}));

// Add P3P headers to please IE8
app.use(addP3PHeader);

// redirect requests to the "verifier" processes
if (config.get('verifier_url')) {
  var verifier_url = urlparse(config.get('verifier_url')).validate().normalize();

  // support requests coming into the verifier hostname as well as those with /verify in the path,
  // iff the verifier is configured explicitly with a distinct hostname
  var verifier_host;
  if (config.get('public_verifier_url') !== config.get('public_url')) {
    verifier_host = urlparse(config.get('public_verifier_url')).validate().host;
  }

  app.use(function(req, res, next) {
    if (/^\/verify$/.test(req.url) ||
        (req.headers.host && verifier_host && req.headers.host === verifier_host))
    {
      forward(
        verifier_url, req, res,
        function(err) {
          if (err) {
            logger.error("error forwarding request:", err);
          }
        });
    } else {
      return next();
    }
  });
}

// #10 if the BROWSERID_FAKE_VERIFICATION env var is defined, we'll include
// fake_verification.js.  This is used during testing only and should
// never be included in a production deployment
if (process.env['BROWSERID_FAKE_VERIFICATION']) {
  app.use(function(req, res, next) {
    if (url.parse(req.url).pathname == '/wsapi/fake_verification') {
      forward(
        browserid_url+req.url, req, res,
        function(err) {
          if (err) {
            logger.error("error forwarding request:", err);
          }
        });
    } else {
      return next();
    }
  });
}

// handle /wsapi reads/writes
var dbwriter_url = urlparse(config.get('dbwriter_url')).validate().normalize().originOnly();

wsapi.routeSetup(app, {
  read_url: browserid_url,
  write_url: dbwriter_url
});

app.use(metrics);

//catch-all
app.use(function(req, res, next) {
  forward(
    static_url+req.url, req, res,
    function(err) {
      if (err) {
        logger.error("error forwarding request:", err);
      }
    });
});

// shutdown nicely on signals
shutdown.handleTerminationSignals(app, function() {
  toobusy.shutdown();
});

var bindTo = config.get('bind_to');
app.listen(bindTo.port, bindTo.host, function(conn) {
  logger.info("running on http://" + app.address().address + ":" + app.address().port);
});